{"record":{"id":"f64e055f55fb59d4","repo":"slackhq/nebula","slug":"errbaddetailsvpnaddr","errorCode":"ErrBadDetailsVpnAddr","errorMessage":"invalid packet, malformed detailsVpnAddr","messagePattern":"invalid packet, malformed detailsVpnAddr","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lighthouse.go","lineNumber":27,"sourceCode":"\t\"net\"\n\t\"net/netip\"\n\t\"slices\"\n\t\"strconv\"\n\t\"sync\"\n\t\"sync/atomic\"\n\t\"time\"\n\n\t\"github.com/gaissmai/bart\"\n\t\"github.com/slackhq/nebula/cert\"\n\t\"github.com/slackhq/nebula/config\"\n\t\"github.com/slackhq/nebula/header\"\n\t\"github.com/slackhq/nebula/logging\"\n\t\"github.com/slackhq/nebula/udp\"\n\t\"github.com/slackhq/nebula/util\"\n)\n\nvar ErrHostNotKnown = errors.New(\"host not known\")\nvar ErrBadDetailsVpnAddr = errors.New(\"invalid packet, malformed detailsVpnAddr\")\n\ntype LightHouse struct {\n\t//TODO: We need a timer wheel to kick out vpnAddrs that haven't reported in a long time\n\tsync.RWMutex //Because we concurrently read and write to our maps\n\tctx          context.Context\n\tamLighthouse bool\n\n\tmyVpnNetworks      []netip.Prefix\n\tmyVpnNetworksTable *bart.Lite\n\tpunchy             *Punchy\n\n\t// localAddrsFn enumerates the underlay addresses we advertise. It is a field so tests can supply simulated\n\t// addresses rather than whatever this machine's NICs happen to be. Set it before Start.\n\tlocalAddrsFn func(*LocalAllowList) []netip.Addr\n\n\t// Local cache of answers from light houses\n\t// map of vpn addr to answers\n\taddrMap map[netip.Addr]*RemoteList","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/lighthouse.go#L9-L45","documentation":"ErrBadDetailsVpnAddr (lighthouse.go) is returned when parsing a detailsVpnAddr field from a lighthouse reply/packet fails because the byte encoding is malformed — the address bytes don't form a valid netip.Addr for the expected certificate version.","triggerScenarios":"A lighthouse answer/upgrade packet contains a detailsVpnAddr whose encoded bytes are the wrong length or format; the v1 fallback parse path fails and returns this error (lighthouse.go:1541).","commonSituations":"Mixed nebula versions (v1 vs v2 certificate/address encoding) on the mesh; corrupted or tampered lighthouse packets; buggy custom message construction.","solutions":["Upgrade all lighthouses and peers to a matching nebula version","Check for packet corruption (NIC offload, MTU) in the path","If building packets yourself, encode the vpn addr with the same format/length nebula expects","Enable debug logging to dump the offending packet and compare with a healthy lighthouse answer"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"// validate encoded addr byte length before sending/accepting detailsVpnAddr\nif len(rawAddrBytes) != expectedAddrLen(certVersion) {\n    // reject malformed detailsVpnAddr\n}","typeGuard":"func validDetailsVpnAddr(a netip.Addr, version cert.Version) bool {\n    return a.IsValid() && !a.IsZero() && addrLenMatchesVersion(a, version)\n}","tryCatchPattern":"addr, version, err := parseDetailsVpnAddr(raw)\nif errors.Is(err, ErrBadDetailsVpnAddr) {\n    // drop packet / log and skip this lighthouse answer\n    return\n}","preventionTips":["Keep all mesh nodes on a consistent nebula version (v1 vs v2 encoding)","Validate address bytes at message construction time","Use errors.Is against the sentinel error, not string matching","Log raw packets at debug level when parse failures spike"],"tags":["network","lighthouse","packet-parsing","nebula"],"backgroundTag":"malformed-packet","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}